azure-kv-contributor-selfgrant-accesspolicy
Contributor/Key Vault Contributor self-adds an access policy to gain data-plane access (access-policy model only).
match
A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.
where
node_class(?vault) == ManagementService and ?vault is a Microsoft.KeyVault/vaults
?vault.properties.enableRbacAuthorization == false (access-policy model)
?principal has EFFECTIVE Microsoft.KeyVault/vaults/accessPolicies/write (Contributor / Key Vault Contributor / Owner) at the vault
emit
| source type | Identity |
|---|---|
| target type | Identity |
| source | ?principal |
| target | ?principal |
| permissions | Microsoft.KeyVault/vaults/accessPolicies/write |
| conditions | service_state |
| state logic | if a deny assignment/deny Azure Policy covers accessPolicies/write: BLOCKED; else ACTIVE |
Narrative
{principal.name} has vault-write on {vault.name} (access-policy model) and can add itself to the access policy, granting itself full data-plane access.
Raw rule rules/derived/azure/keyvault.yaml
id: azure-kv-contributor-selfgrant-accesspolicy
emits: CanGrantPermission
description: Contributor/Key Vault Contributor self-adds an access policy to gain data-plane access (access-policy
model only).
match:
- - principal: null
- HasPermission
- vault: null
where:
- node_class(?vault) == ManagementService and ?vault is a Microsoft.KeyVault/vaults
- ?vault.properties.enableRbacAuthorization == false (access-policy model)
- ?principal has EFFECTIVE Microsoft.KeyVault/vaults/accessPolicies/write (Contributor / Key Vault Contributor
/ Owner) at the vault
emit:
source_type: Identity
target_type: Identity
source: ?principal
target: ?principal
permissions:
- Microsoft.KeyVault/vaults/accessPolicies/write
conditions:
- service_state
state_logic: 'if a deny assignment/deny Azure Policy covers accessPolicies/write: BLOCKED; else ACTIVE'
confidence: '0.95'
derived_from:
- <HasPermission edge_id (accessPolicies/write)>
false_positive_note: 'CRITICAL model gate: this ONLY works when enableRbacAuthorization==false. On an
RBAC-model vault, Microsoft.KeyVault/vaults/write does NOT grant data-plane access; the self-grant
then requires Microsoft.Authorization/roleAssignments/write (see the RBAC variant rule). Contributor
on an RBAC vault CANNOT read secrets.'
narrative: '{principal.name} has vault-write on {vault.name} (access-policy model) and can add itself
to the access policy, granting itself full data-plane access.'